2018 CVEs (page 129)
Page 129 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-8155 | Medium | 5.4 | 2018-05-09 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8154 | Critical | 9.8 | 2018-05-09 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchan… |
CVE-2018-8153 | Medium | 5.4 | 2018-05-09 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoof… |
CVE-2018-8152 | Medium | 5.4 | 2018-05-09 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange… |
CVE-2018-8151 | Medium | 4.3 | 2018-05-09 | An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerab… |
CVE-2018-8150 | Medium | 6.5 | 2018-05-09 | A security feature bypass vulnerability exists when the Microsoft Outlook attachment block filter does not properly handle attachments, aka "Microsoft Outlook… |
CVE-2018-8149 | Medium | 5.4 | 2018-05-09 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8148 | High | 7.8 | 2018-05-09 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8147 | High | 7.8 | 2018-05-09 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8145 | High | 7.5 | 2018-05-09 | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to… |
CVE-2018-8141 | Medium | 4.7 | 2018-05-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8139 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-8137 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-8136 | High | 7.8 | 2018-05-09 | A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects… |
CVE-2018-8134 | High | 7.0 | 2018-05-09 | An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."… |
CVE-2018-8133 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8132 | Medium | 5.3 | 2018-05-09 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil… |
CVE-2018-8130 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8129 | Medium | 5.3 | 2018-05-09 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil… |
CVE-2018-8128 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-8127 | Medium | 5.5 | 2018-05-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8126 | High | 8.8 | 2018-05-09 | A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies, aka "Internet Explorer Securi… |
CVE-2018-8124 | High | 7.0 | 2018-05-09 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8123 | Medium | 4.3 | 2018-05-09 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8122 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8120 | High | 7.0 | 2018-05-09 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8119 | Medium | 5.6 | 2018-05-09 | A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Az… |
CVE-2018-8114 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8112 | Medium | 4.3 | 2018-05-09 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
CVE-2018-1039 | High | 7.8 | 2018-05-09 | A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard, aka ".NET Framework Device Guard Securit… |
CVE-2018-1025 | Medium | 4.3 | 2018-05-09 | An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka "Microsoft Browser Information Disclos… |
CVE-2018-1022 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-1021 | Medium | 4.3 | 2018-05-09 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-0961 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data, aka "Hyper-V vSMB Remote Code E… |
CVE-2018-0959 | High | 7.6 | 2018-05-09 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-0958 | Medium | 5.3 | 2018-05-09 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil… |
CVE-2018-0955 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-0954 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-0953 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-0951 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-0946 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-0945 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
CVE-2018-0943 | High | 7.5 | 2018-05-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-0854 | Medium | 5.3 | 2018-05-09 | A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard, aka "Windows Security Feature By… |
CVE-2018-0824 | High | 8.8 | 2018-05-09 | A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows… |
CVE-2018-0765 | High | 7.5 | 2018-05-09 | A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." Th… |
CVE-2018-10828 | Medium | 5.5 | 2018-05-09 | An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object… |
CVE-2018-10770 | Critical | 9.8 | 2018-05-09 | download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password. |
CVE-2018-10940 | Medium | 5.5 | 2018-05-09 | The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the… |
CVE-2018-1089 | High | 7.5 | 2018-05-09 | 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer… |
CVE-2018-8912 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitr… |
CVE-2018-8911 | Medium | 6.5 | 2018-05-09 | Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary… |
CVE-2018-10683 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access… |
CVE-2018-10682 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication… |
CVE-2018-10830 | High | 7.8 | 2018-05-09 | In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified… |
CVE-2018-10184 | High | 7.5 | 2018-05-09 | An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against t… |
CVE-2018-10831 | High | 7.5 | 2018-05-09 | Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with… |
CVE-2018-10827 | High | 7.5 | 2018-05-09 | LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist, because public_html/logs/not_found… |
CVE-2018-10817 | Medium | 6.1 | 2018-05-09 | Severalnines ClusterControl before 1.6.0-4699 allows XSS. |
CVE-2018-10705 | High | 7.5 | 2018-05-09 | The Owned smart contract implementation for Aurora DAO (AURA), an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner fun… |
CVE-2018-6921 | Medium | 5.5 | 2018-05-08 | In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network subsystem, small am… |
CVE-2018-6920 | Medium | 5.5 | 2018-05-08 | In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to use… |
CVE-2018-10812 | Medium | 4.1 | 2018-05-08 | The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency b… |
CVE-2018-8897 | High | 7.8 | 2018-05-08 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… |
CVE-2018-6511 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when… |
CVE-2018-6510 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when… |
CVE-2018-1000179 | High | 7.5 | 2018-05-08 | A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp li… |
CVE-2018-1000178 | Critical | 9.8 | 2018-05-08 | A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer… |
CVE-2018-1000177 | Medium | 5.4 | 2018-05-08 | A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jel… |
CVE-2018-1000176 | Medium | 6.5 | 2018-05-08 | An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/Extend… |
CVE-2018-1000175 | Medium | 6.5 | 2018-05-08 | A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the H… |
CVE-2018-1000174 | Medium | 6.1 | 2018-05-08 | An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to… |
CVE-2018-1000173 | Medium | 5.9 | 2018-05-08 | A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to i… |
CVE-2018-1000168 | High | 7.5 | 2018-05-08 | nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segment… |
CVE-2018-1248 | Medium | 6.1 | 2018-05-08 | RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulner… |
CVE-2018-1247 | High | 7.1 | 2018-05-08 | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin us… |
CVE-2018-1239 | High | 7.2 | 2018-05-08 | Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote applicatio… |
CVE-2018-10380 | High | 7.8 | 2018-05-08 | kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack. |
CVE-2018-10809 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-10806 | Medium | 5.4 | 2018-05-08 | An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/f… |
CVE-2018-10805 | Medium | 6.5 | 2018-05-08 | ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. |
CVE-2018-10804 | Medium | 6.5 | 2018-05-08 | ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. |
CVE-2018-10734 | Critical | 9.8 | 2018-05-08 | KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in certain circumstan… |
CVE-2018-10801 | Medium | 6.5 | 2018-05-08 | TIFFClientOpen in tif_unix.c in LibTIFF 3.8.2 has memory leaks, as demonstrated by bmp2tiff. |
CVE-2018-10799 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.loc… |
CVE-2018-10798 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the re… |
CVE-2018-10796 | High | 7.8 | 2018-05-08 | In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other imp… |
CVE-2018-1256 | High | 8.1 | 2018-05-07 | Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In… |
CVE-2018-1413 | Medium | 5.4 | 2018-05-07 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2018-1313 | Medium | 5.3 | 2018-05-07 | In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and… |
CVE-2018-10795 | High | 8.8 | 2018-05-07 | Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically proces… |
CVE-2018-10780 | Medium | 6.5 | 2018-05-07 | Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read. |
CVE-2018-10779 | Medium | 6.5 | 2018-05-07 | TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. |
CVE-2018-10778 | High | 7.8 | 2018-05-07 | Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of serv… |
CVE-2018-10777 | High | 7.8 | 2018-05-07 | Buffer overflow in the WriteMP3GainAPETag function in apetag.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application cr… |
CVE-2018-10776 | High | 7.8 | 2018-05-07 | The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application… |
CVE-2018-10775 | Medium | 6.5 | 2018-05-07 | NULL pointer dereference in the _fields_add function in fields.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (… |
CVE-2018-10774 | Medium | 6.5 | 2018-05-07 | Read access violation in the isiin_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a denial of service (a… |
CVE-2018-10773 | Medium | 6.5 | 2018-05-07 | NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (applic… |
CVE-2018-10772 | Medium | 6.5 | 2018-05-07 | The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or possibly have unsp… |